by Kastro
Paper/Archive/CVE-2020-24634

CVE-2020-24634

hpe — An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP M…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.5.815 × 2016.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An attacker is able to remotely inject arbitrary commands by sending especially crafted packets destined to the PAPI (Aruba Networks AP Management protocol) UDP port (8211) of access-pointsor controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1, 2.2.0.0 and below; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below ; 6.4.4.23, 6.5.4.17, 8.2.2.9, 8.3.0.13, 8.5.0.10, 8.6.0.5, 8.7.0.0 and below.

Affected

ProductAffectedFixed inSource
Aruba 9000 Gateway2.1.0.1–CNA
Aruba 9000 Gateway2.2.0.0 and below–CNA
Aruba 7000 Series Mobility Controllers6.4.4.23–CNA
Aruba 7000 Series Mobility Controllers6.5.4.17–CNA
Aruba 7000 Series Mobility Controllers8.2.2.9–CNA
Aruba 7000 Series Mobility Controllers8.3.0.13–CNA
Aruba 7000 Series Mobility Controllers8.5.0.10–CNA
Aruba 7000 Series Mobility Controllers8.6.0.5–CNA
Aruba 7000 Series Mobility Controllers8.7.0.0 and below–CNA
Aruba 7200 Series Mobility Controllers6.4.4.23–CNA
Aruba 7200 Series Mobility Controllers6.5.4.17–CNA
Aruba 7200 Series Mobility Controllers8.2.2.9–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsupport.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbnw04072en_us